I'm working in code to elevate an account with the Read role to a specific account with the Contribute role in order to create a list item.
I currently get the
SPUserToken for the contribution account by reading
and I was suprised to note that this works as long as you have the Read role on the web. (This means I don't need to open the web in a
RunWithElevatedPrivileges block just to get the token - brilliant!)
However, if alternatively I try to use
then I am denied access - because the Read role doesn't have the Enumerate Permissions permission. Microsoft have explicitly checked for that permission before returning the token.
I am rather worried by the fact that Microsoft have seen fit to block off one way of getting the token, but not the other. The documentation for
GetUserToken does say it checks permissions, but I'd expect any other method of getting the token to make such a check too.
Can anyone tell me if there's a good reason for this difference?